DNS leak test

Before your browser opens a site it asks a DNS resolver for the site’s address. Whoever runs that resolver sees every name you look up. On a VPN those lookups should go through the tunnel to the VPN’s resolver; when they go to your internet provider’s resolver instead, the provider still sees where you go. That is a DNS leak.

How the test works

Your browser looks up 8 random names under leak.proxyspace.pro that nobody has used before. No resolver has them cached, so each one has to ask our DNS server, and we see the address it asks from. The table lists those resolvers with their country and network (ASN), next to the network you browse from. Results usually arrive within 5 seconds; the names and resolvers are forgotten after 10 minutes.

Reading the result

• Your network: the resolver belongs to the same network as your connection. With a VPN this is the VPN’s own DNS. No leak.
• Public DNS: Cloudflare, Google, Quad9 or OpenDNS. Fine if you, your browser’s secure DNS or your VPN chose it.
• Other network: a resolver outside your connection’s network. If that is your home or mobile provider while the VPN is on, your DNS leaks.

How to fix a DNS leak

• Turn on the VPN app’s DNS leak protection or “use VPN DNS only” option, and its kill switch.
• On Windows, disable IPv6 on the adapter or use a VPN that tunnels IPv6; Windows asks every configured DNS server in parallel.
• In the browser, turn on secure DNS (DNS over HTTPS) with a provider you trust.
• Behind a proxy, use socks5h:// so the proxy resolves hostnames instead of your machine.

Then check the other ways a connection gives you away: the WebRTC leak test, what is my IP and the proxy judge. To see who runs a resolver, look its address up in the ASN lookup.